CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-0387 – EDS-4000/G4000 Series IP Forwarding Vulnerability
https://notcve.org/view.php?id=CVE-2024-0387
26 Feb 2024 — The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests. Las series EDS-4000/G4000 anteriores a la versión 3.2 incluyen capacidades de reenvío de IP que los usuarios no pueden desactivar. Un atacante puede enviar solicitudes al producto y reenviarlas al objetivo. • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-237129-eds-4000-g4000-series-ip-forwarding-vulnerability?viewmode=0 • CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-6094 – OnCell G3150A-LTE Series: Web Server Transmits Cleartext Credentials
https://notcve.org/view.php?id=CVE-2023-6094
31 Dec 2023 — A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the web browser and server may obtain sensitive information. This type of attack could be executed to gather sensitive information or to facilitate a subsequent attack against the target. Se ha identificado una vulnerabilidad en las versiones de firmware de la serie O... • https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3150a-lte-series-multiple-web-application-vulnerabilities-and-security-enhancement • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-6093 – OnCell G3150A-LTE Series: Clickjacking Vulnerability
https://notcve.org/view.php?id=CVE-2023-6093
31 Dec 2023 — A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the user is interacting with. This vulnerability may lead the attacker to trick the user into interacting with the application. Se ha identificado una vulnerabilidad en las versiones de firmware de la serie OnCell G3150A-LTE v1.3 y anteriores. La vulnerabilidad es el resultado... • https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3150a-lte-series-multiple-web-application-vulnerabilities-and-security-enhancement • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.8EPSS: 0%CPEs: 20EXPL: 0CVE-2023-5962 – ioLogik E1200 Series: Weak Cryptographic Algorithm Vulnerability
https://notcve.org/view.php?id=CVE-2023-5962
23 Dec 2023 — A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get unexpected authorization. Se ha identificado una vulnerabilidad de algoritmo criptográfico débil en las versiones de firmware de la serie ioLogik E1200 v3.3 y anteriores. Esta vulnerabilidad puede ayudar a un atacante a comprometer la confidencialidad ... • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-328: Use of Weak Hash •
CVSS: 10.0EPSS: 0%CPEs: 20EXPL: 1CVE-2023-5961 – ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability
https://notcve.org/view.php?id=CVE-2023-5961
23 Dec 2023 — A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user. Se identificó una vulnerabilidad de Cross-Site Request Forgery (CSRF) en las versiones de firmware de la serie ioLogik E1200... • https://github.com/HadessCS/CVE-2023-5961 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-5035 – Cookie Without Secure Flag
https://notcve.org/view.php?id=CVE-2023-5035
02 Nov 2023 — A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation. Se identificó una vulnerabilidad en las versiones de firmware Series PT-G503 anteriores a la v5.2, donde el atributo Seguro para cookies s... • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities • CWE-319: Cleartext Transmission of Sensitive Information CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-4217 – Session cookies attribute not set properly
https://notcve.org/view.php?id=CVE-2023-4217
02 Nov 2023 — A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation. Se identificó una vulnerabilidad en las versiones Series PT-G503 anteriores a la v5.2, donde el atributo de cookies de sesión no está configurado correctamente en la aplicación afectada. La vulnerabilidad puede generar ries... • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities • CWE-668: Exposure of Resource to Wrong Sphere CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag •
CVSS: 7.8EPSS: 0%CPEs: 54EXPL: 0CVE-2023-5627 – Incorrect Implementation of Authentication Algorithm Vulnerability
https://notcve.org/view.php?id=CVE-2023-5627
01 Nov 2023 — A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized access to the web service. Se ha identificado una vulnerabilidad en Series NPort 6000 que hace vulnerable el mecanismo de autenticación. Esta vulnerabilidad surge de la implementación incorrecta de la protección de información confidencial, lo que pot... • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-232905-nport-6000-series-incorrect-implementation-of-authentication-algorithm-vulnerability • CWE-257: Storing Passwords in a Recoverable Format CWE-287: Improper Authentication CWE-303: Incorrect Implementation of Authentication Algorithm CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.8EPSS: 0%CPEs: 16EXPL: 0CVE-2023-4452 – Web Server Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2023-4452
01 Nov 2023 — A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnerability stems from insufficient input validation in the URI, potentially enabling malicious users to trigger the device reboot. Se ha identificado una vulnerabilidad en Series EDR-810, EDR-G902 y EDR-G903, lo que las hace vulnerables a la vulnerabilidad de denegación de servicio. Esta vulnerabilidad se debe a una validación de entrada insuficiente en el... • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-234880-edr-810-g902-g903-series-web-server-buffer-overflow-vulnerability • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.0EPSS: 0%CPEs: 254EXPL: 0CVE-2023-4929 – NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability
https://notcve.org/view.php?id=CVE-2023-4929
03 Oct 2023 — All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices. Todas las versiones de firmware de la serie NPort 5000 se ven afectadas por una vulnerabilidad de validación inadecuada de verificación de integridad. Esta vulnerabilidad se debe a comprobaciones insuficientes de l... • https://www.moxa.com/en/support/product-support/security-advisory/mpsa-233328-nport-5000-series-firmware-improper-validation-of-integrity-check-vulnerability • CWE-354: Improper Validation of Integrity Check Value •